A computer network is typically configured to incorporate security functionality in order to protect the computers of the network against malicious activity. Such malicious activity can include, for example, ransomware attacks in which malware infecting one or more computers of the computer network will systematically encrypt files on those computers and possibly other computers of the network. The attacker withholds the corresponding decryption key unless a ransom is paid by the victim. Conventional techniques for combatting ransomware attacks can be problematic in that such techniques can take an unduly long amount of time to detect an attack in progress. The longer it takes to detect the attack, the greater the number of files that are encrypted, and the greater the adverse impact of the attack on the victim.